Getting Data In

How to query against Splunk API a saved search without the search Id?

Mathanjey
Explorer

Can someone suggest how to query against Splunk API for a saved search without the Search Id? Basically we have a requirement to make a call against Splunk API (REST) for a saved search and get results.

0 Karma

woodcock
Esteemed Legend

You did not describe what your IDE or language are but Splunk SDK dox are here:
http://dev.splunk.com/view/sdks/SP-CAAADP7

If you want to do it via the REST API - then take a look at these two tutorials:
http://dev.splunk.com/view/SP-CAAADQ5
http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK

REST API reference docs for saved searches are here: http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2...

You call dispatch for the search you care about and then you should be off and running.

0 Karma

woodcock
Esteemed Legend

Did you try this?

0 Karma

koshyk
Super Champion

You can first list all your saved Searches like this

| rest services/search/jobs | search isSavedSearch=1 | stats count by label

then you can specifically interrogate them if needed

| rest services/search/jobs | search label="my special saved search"
0 Karma

Mathanjey
Explorer

I have a saved search and wanted to invoke the saved search via rest api and get results from the api.

0 Karma

woodcock
Esteemed Legend

Are you OK now?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So you want to run the saved search or want to get information about the saved search (and what information if yes)?

0 Karma

woodcock
Esteemed Legend

What he asked.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...